Security

New-sqmCertificateRequest

Generates a Certificate Signing Request (CSR), the matching INF, and a detailed order datasheet for an internal/external Certificate Authority — for Always On, TDE, SSL, or Service Broker certificate purposes.

Module: sqmSQLTool
Requires: dbatools (conditional)
ShouldProcess: Yes (Low)
Output: PSCustomObject

Execution Flow

START -CertificateName given? No dbatools check (via Connect-DbaInstance) + read sys.certificates, endpoint binding, AG SANs Resolve Purpose-specific Key Usage / EKU OIDs Build Subject Alternative Names (incl. AG listeners) Write INF file to OutputPath ShouldProcess: run certreq.exe? Confirmed certreq.exe -new → .csr Declined/WhatIf Write German order datasheet (checklist, post-receipt install steps) Return PSCustomObject (CsrGenerated, NextStep) DONE
dbatools is only used when -CertificateName is supplied (to inspect an existing cert's endpoint binding and AG listeners for SAN generation). Without it, the function works as a pure offline CSR/INF generator and does not require dbatools. The actual certreq.exe -new call is the only state-changing action and is gated by ShouldProcess.

Parameters

ParameterTypeRequiredDescription
-SqlInstanceStringOptionalSQL instance to inspect for an existing certificate/AG listeners (only used with -CertificateName).
-SqlCredentialPSCredentialOptionalSQL authentication credential.
-CertificateNameStringOptionalExisting certificate to use as template for Subject/SANs.
-DatabaseStringOptionalDatabase to query for the certificate. Default: master.
-SubjectStringOptionalCertificate subject (CN=...).
-SubjectAlternativeNamesString[]OptionalAdditional SAN entries.
-KeyLengthIntOptional2048 / 4096. Default: 4096.
-ValidityYearsIntOptional1–10 years. Default: 3.
-PurposeStringOptionalAlwaysOn / TDE / SSL / ServiceBroker / UserDefined. Default: SSL.
-OutputPathStringOptionalOutput directory. Default via Get-sqmDefaultOutputPath\Cert.
-OrganizationStringOptionalO= field for the CSR subject.
-OrganizationalUnitStringOptionalOU= field.
-LocalityStringOptionalL= field.
-StateStringOptionalS= field.
-CountryStringOptionalC= field. Default: DE.
-EnableExceptionSwitchOptionalThrows terminating errors instead of returning an error status object.
-WhatIf / -ConfirmSwitchOptionalStandard ShouldProcess support for the certreq.exe call.

Return Value

Returns a PSCustomObject with: SqlInstance, ExistingCertName, Subject, SubjectAltNames, Purpose, KeyLength, ValidityYears, OutputDirectory, InfFile, CsrFile, CsrGenerated, OrderSheetFile, NextStep.

Examples

Example 1 — SSL certificate request

New-sqmCertificateRequest -Subject "CN=sql01.firma.de" -Purpose "SSL" -Organization "Firma GmbH"

Example 2 — Renewal based on existing AG certificate

New-sqmCertificateRequest -SqlInstance "SQL01" -CertificateName "AG_HADR_Cert" -Purpose "AlwaysOn"